In a busy networking environment, such as a large corporation or an Internet service provider (ISP), it is often useful to be able to monitor some or all of the traffic passing through the network, such as the traffic that passes through a router between the network and the Internet. Numerous applications for such monitoring exist, such as intrusion detection systems (IDS), antivirus and antispam monitoring, or bandwidth monitoring. A significant barrier to such monitoring is the sheer quantity of data to be monitored. Even in a relatively small corporate environment, network traffic through the central router may represent dozens of simultaneous transactions, for multiple users across multiple protocols. As the networking environment increases in size, so too does the magnitude of data to monitored, quickly surpassing the point where a single monitoring system can handle the workload.
Load-balancing is an approach intended to help alleviate this problem. Multiple monitoring systems are utilized, and the data to be monitored is spread across them. However, load-balancing introduces different problems, such as how to distribute the data across multiple servers quickly and efficiently. While several software-based approaches exist, they cannot scale to handle a large networking environment; as additional data passes through a central router, a software load-balancing system becomes a new bottleneck. Software takes too long to process data and forward it to the appropriate monitoring server, which results in loss of packets.